It should be noted that some discussions of malicious software use the term “virus” in a narrow sense as relating to software having particular characteristics in terms of propagation, possibly also multiplication, and effect which are distinct from other forms such as “trojan horses”, “worms”, etc. However, in this specification, including the appended claims, the term virus is used in the general sense of any software which by malice (or accident) causes undesired effects.
Conventional virus checkers find viruses by looking for known patterns in files, by checking for new or changed files in a file system or by running suspicious programs in a sandbox emulator environment to detect virus-like activity.
The increasing use of email, over both the Internet and private networks, increases the exposure of individual end users and operations to malicious disruption. Recently there have been email-borne virus outbreaks which have spread across the world in a matter of hours. Some degree of protection can be achieved by scanning emails and their attachments for viruses and obviously this is best done on a centralised basis, e.g. by ISPs and others who operate email gateways, rather than leaving it to end users who may or may not have the resources, knowledge or inclination to take their own anti-virus measures.
However, even with centralised scanning there is still a problem with new viruses. Leaving aside the question of how a new virus is first detected, whether by measures taken by an ISP or similar, or at an end user's machine, the steps necessary to mitigate the effect of an outbreak of it take time to put into effect, and by the time that they have been, the worst effects of the outbreak may already have occurred, all across the world. These steps typically include identifying a characteristic string of bytes or other “signature” which identifies the virus, disseminating this information to virus-scanning sites, and programming the scanners with this information, all of which takes time, and meanwhile the outbreak is free to spread.
This has become particularly problematic recently with the type of virus which can effectively multiply itself by generating and sending copies of the email which contains it, e.g. by accessing an email address book (e.g. that available to an end user's email client) and then using services available on the machine to send a copy of the email and itself to any or all of the addresses found. This tactic can propagate between continents in a matter of minutes and result in a geometric “explosion” of the number of instances of it.